Uber's production environment relies on a complex network of microservices and assets governed by IAM policies. Managing these policies effectively without disrupting production is challenging, as highlighted by an incident where an accidental IAM policy change caused Uber Eats outages. To address this, Uber introduced a Policy Simulator tool that allows policy authors to preview the impact of proposed changes in real time.   #aws   #iam   #build

This post introduces AWS Infrastructure Canarytoken, a new free tool that helps deploy decoy AWS resources (DynamoDB, S3, SSM Parameters, etc.) to detect attackers exploring compromised AWS accounts.   #monitor   #aws   #defend

Built on the V8 JavaScript runtime, Workers benefits from V8's hardened security features, such as memory protection keys and compressed pointers. Cloudflare has implemented internal modifications to V8 to enhance security, using memory protection keys to isolate different scripts (isolates) from each other, preventing data leaks between them.   #cloudflare   #defend   #explain   #containers

New ways AWS is using Firecracker for: Bedrock AgentCore, and Aurora DSQL.   #containers   #explain

A critical security vulnerability in Notion 3.0's AI Agents demonstrates how the combination of LLM agents, tool access, and long-term memory creates exploitable attack vectors for data exfiltration.   #ai   #attack   #saas

This post is about how Wiz used a data-driven methodology to uncover and stop anomalous IMDS usage, and how that approach led them to discover a zero-day vulnerability being exploited in the wild in a popular web service.   #attack   #aws   #defend

Orca Research Pod details how misconfigured pull_request_target workflows in GitHub Actions can lead to RCE, secret exfiltration, and supply chain attacks.   #attack   #ci/cd   #supply-chain

Wiz Research discovers one in five organizations exposed to systemic risks in vibe-coded applications. These risks include client-side authentication flaws, exposed API keys, permissive database access, and publicly accessible internal applications.   #defend   #ai   #build

Post examining real-world risks created by scanner access, from password exposure to potential pivots into CI/CD infrastructure.   #ci/cd   #attack

GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.   #announcement   #supply-chain   #defend

A tool to help pentesters quickly identify privileged principals and second-order privilege escalation opportunities in unfamiliar AWS accounts.

A modern open-source Kubernetes auditing and investigation tool. You can also refer to the companion blog post.

A super fast CLI tool to decode and encode JWTs.

Scan for secrets in dangling commits on GitHub using GH Archive data.

AWS recently announced that AWS Organizations now offers full AWS IAM policy language support for service control policies (SCPs). With this feature, you can use conditions, individual resource Amazon Resource Names (ARNs), and the NotAction element with Allow statements.

A structured workflow where security teams define acceptable compensating controls, developers implement them, and an automated system validates their effectiveness.

The GCE Security Risk Overview page now shows top security findings, vulnerability findings over time, and common vulnerabilities and exploits (CVEs) on your virtual machines.